Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/cms-core | composer | >= 13.0.0, < 13.4.34 | 13.4.34 |
| typo3/cms-core | composer | >= 14.0.0, < 14.3.6 | 14.3.6 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from a flawed referrer enforcement mechanism in TYPO3 CMS versions 13.0.0-13.4.33 and 14.0.0-14.3.5. The core ReferrerEnforcer class, specifically its resolveReferrerType method, was designed to determine if a request originated from the 'same-origin' by comparing the HTTP_REFERER header against the directory of the entry script ($this->requestDir).
However, a significant architectural change in TYPO3 v13.0 caused the backend and Install Tool applications to be served from the site's main entry script (typically /index.php) located in the document root, rather than their previous dedicated typo3/ directory. This change meant that the $this->requestDir for backend and Install Tool requests became the site's root directory, which is also shared by frontend pages.
Consequently, the resolveReferrerType function would incorrectly classify requests originating from any script on the same domain (e.g., a frontend page) as 'same-origin' for backend and Install Tool endpoints. This bypasses the intended security control. An attacker exploiting a Cross-Site Scripting (XSS) vulnerability on a frontend page could then execute JavaScript to send Fetch/XHR requests to sensitive backend or Install Tool endpoints, leveraging the authenticated victim's session.
The provided patches address this by:
TYPO3\CMS\Core\Http\Security\ReferrerEnforcer::resolveReferrerType an abstract method.TYPO3\CMS\Backend\Http\Security\ReferrerEnforcer::resolveReferrerType and TYPO3\CMS\Install\Http\Security\ReferrerEnforcer::resolveReferrerType.https://example.org/typo3/ for backend or https://example.org/?__typo3_install for install tool) rather than just the shared document root directory.Therefore, the vulnerable function is the original resolveReferrerType method in the TYPO3\CMS\Core\Http\Security\ReferrerEnforcer class, as its logic became ineffective due to the architectural changes in TYPO3 v13.0+.
TYPO3\CMS\Core\Http\Security\ReferrerEnforcer::resolveReferrerTypetypo3/sysext/core/Classes/Http/Security/ReferrerEnforcer.php